PT-2022-6091 · Fortinet · Fortianalyzer+1

Published 2022-07-05 · Updated 2022-07-27 · CVE-2022-27483

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions 6.0.x through 7.0.3 Fortinet FortiAnalyzer versions 6.0.x through 7.0.3

Description The issue exists due to improper neutralization of special elements used in an operating system command, allowing an attacker to execute arbitrary shell code as the root user via diagnose system CLI commands.

Recommendations For Fortinet FortiManager versions 6.0.x through 7.0.3, consider disabling the diagnose system CLI commands until a patch is available. For Fortinet FortiAnalyzer versions 6.0.x through 7.0.3, consider disabling the diagnose system CLI commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00029

CVE-2022-27483

Affected Products

Fortianalyzer

Fortimanager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-27483 · Security Note
• https://bdu.fstec.ru/vul/2023-00029 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-049 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27483 · Vendor Advisory
• https://t.me/cvenotify/33397 · Telegram Post
• https://t.me/cibsecurity/46555 · Telegram Post